Add vendor publish to document system
Replace the old snapshot-based system for vendors with the publish document system, mirroring the prior processing activity / DPIA / TIA migration. Includes the GraphQL mutation, MCP tool, CLI command, n8n operation, frontend publish dialog, e2e tests, and a prosemirror register template covering vendor profile fields plus per-vendor sections for services, contacts, risk assessments, compliance reports, BAA and DPA agreements. The vendor register lives as a generated DocumentTypeRegister document on the organization, reused across publishes (the major version bumps on every republish). Approvers can be passed in to create a draft pending approval; otherwise the version is published immediately. The frontend Vendors page exposes a Publish button and a Document link button when the document exists, and pre-fills the previous default approvers. Remove snapshot mode entirely from vendors and their sub-entities: drop snapshotId/sourceId from GraphQL Vendor type and VendorFilter; remove SnapshotsTypeVendors from the snapshot registry and delete Vendors.Snapshot, VendorSnapshotter interface and all *.InsertVendorSnapshots methods on contacts, services, risk assessments, compliance reports, BAA and DPA. Drop the snapshot routes and banner from the frontend. The snapshot_id columns remain in the database but are now filtered out with snapshot_id IS NULL. Add Get/Upsert/Clear GeneratedDocumentID methods on Vendor backed by a new vendors_document_id column on generated_documents, matching the ProcessingActivity/Finding/Obligation pattern. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
@@ -104,7 +104,7 @@ func TestSnapshot_Delete(t *testing.T) {
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID().String(),
|
||||
"name": fmt.Sprintf("Snapshot to Delete %d", time.Now().UnixNano()),
|
||||
"type": "VENDORS",
|
||||
"type": "RISKS",
|
||||
},
|
||||
}, &createResult)
|
||||
require.NoError(t, err)
|
||||
@@ -140,7 +140,7 @@ func TestSnapshot_List(t *testing.T) {
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
// Create multiple snapshots
|
||||
snapshotTypes := []string{"RISKS", "VENDORS"}
|
||||
snapshotTypes := []string{"RISKS"}
|
||||
for i, snapshotType := range snapshotTypes {
|
||||
query := `
|
||||
mutation CreateSnapshot($input: CreateSnapshotInput!) {
|
||||
@@ -219,7 +219,7 @@ func TestSnapshot_Types(t *testing.T) {
|
||||
t.Parallel()
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
snapshotTypes := []string{"RISKS", "VENDORS"}
|
||||
snapshotTypes := []string{"RISKS"}
|
||||
|
||||
for _, snapshotType := range snapshotTypes {
|
||||
t.Run(snapshotType, func(t *testing.T) {
|
||||
|
||||
336
e2e/console/vendor_publish_test.go
Normal file
336
e2e/console/vendor_publish_test.go
Normal file
@@ -0,0 +1,336 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package console_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/e2e/internal/factory"
|
||||
"go.probo.inc/probo/e2e/internal/testutil"
|
||||
)
|
||||
|
||||
func TestVendor_PublishVendorList(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run(
|
||||
"publish without approvers publishes immediately",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
factory.CreateVendor(owner, factory.Attrs{"name": "Test Vendor"})
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishVendorListInput!) {
|
||||
publishVendorList(input: $input) {
|
||||
documentEdge {
|
||||
node {
|
||||
id
|
||||
writeMode
|
||||
status
|
||||
}
|
||||
}
|
||||
documentVersionEdge {
|
||||
node {
|
||||
id
|
||||
title
|
||||
documentType
|
||||
status
|
||||
major
|
||||
minor
|
||||
content
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishVendorList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
WriteMode string `json:"writeMode"`
|
||||
Status string `json:"status"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Title string `json:"title"`
|
||||
DocumentType string `json:"documentType"`
|
||||
Status string `json:"status"`
|
||||
Major int `json:"major"`
|
||||
Minor int `json:"minor"`
|
||||
Content string `json:"content"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishVendorList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
doc := result.PublishVendorList.DocumentEdge.Node
|
||||
assert.NotEmpty(t, doc.ID)
|
||||
assert.Equal(t, "GENERATED", doc.WriteMode)
|
||||
assert.Equal(t, "ACTIVE", doc.Status)
|
||||
|
||||
ver := result.PublishVendorList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "REGISTER", ver.DocumentType)
|
||||
assert.Equal(t, "PUBLISHED", ver.Status)
|
||||
assert.Equal(t, 1, ver.Major)
|
||||
assert.Equal(t, 0, ver.Minor)
|
||||
assert.Contains(t, ver.Content, "Purpose")
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"publish with approvers creates draft pending approval",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishVendorListInput!) {
|
||||
publishVendorList(input: $input) {
|
||||
documentEdge {
|
||||
node { id writeMode }
|
||||
}
|
||||
documentVersionEdge {
|
||||
node { id status major }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var result struct {
|
||||
PublishVendorList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
WriteMode string `json:"writeMode"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Status string `json:"status"`
|
||||
Major int `json:"major"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishVendorList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
"approverIds": []string{owner.GetProfileID().String()},
|
||||
},
|
||||
},
|
||||
&result,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
doc := result.PublishVendorList.DocumentEdge.Node
|
||||
assert.NotEmpty(t, doc.ID)
|
||||
assert.Equal(t, "GENERATED", doc.WriteMode)
|
||||
|
||||
ver := result.PublishVendorList.DocumentVersionEdge.Node
|
||||
assert.NotEmpty(t, ver.ID)
|
||||
assert.Equal(t, "PENDING_APPROVAL", ver.Status)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"second publish reuses document and bumps major version",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
factory.CreateVendor(owner, factory.Attrs{"name": "Reuse Vendor"})
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishVendorListInput!) {
|
||||
publishVendorList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
documentVersionEdge { node { id major } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var r1, r2 struct {
|
||||
PublishVendorList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
Major int `json:"major"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishVendorList"`
|
||||
}
|
||||
|
||||
input := map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
}
|
||||
|
||||
err := owner.Execute(query, input, &r1)
|
||||
require.NoError(t, err)
|
||||
|
||||
err = owner.Execute(query, input, &r2)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t,
|
||||
r1.PublishVendorList.DocumentEdge.Node.ID,
|
||||
r2.PublishVendorList.DocumentEdge.Node.ID,
|
||||
"should reuse same document",
|
||||
)
|
||||
assert.Equal(t, 1, r1.PublishVendorList.DocumentVersionEdge.Node.Major)
|
||||
assert.Equal(t, 2, r2.PublishVendorList.DocumentVersionEdge.Node.Major)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"organization vendorsDocument links to published document",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
factory.CreateVendor(owner, factory.Attrs{"name": "Linked Vendor"})
|
||||
|
||||
const publishQuery = `
|
||||
mutation($input: PublishVendorListInput!) {
|
||||
publishVendorList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
documentVersionEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var publishResult struct {
|
||||
PublishVendorList struct {
|
||||
DocumentEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentEdge"`
|
||||
DocumentVersionEdge struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"node"`
|
||||
} `json:"documentVersionEdge"`
|
||||
} `json:"publishVendorList"`
|
||||
}
|
||||
|
||||
err := owner.Execute(
|
||||
publishQuery,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
&publishResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
docID := publishResult.PublishVendorList.DocumentEdge.Node.ID
|
||||
|
||||
const orgQuery = `
|
||||
query($id: ID!) {
|
||||
node(id: $id) {
|
||||
... on Organization {
|
||||
id
|
||||
vendorsDocument { id }
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
var orgResult struct {
|
||||
Node struct {
|
||||
ID string `json:"id"`
|
||||
VendorsDocument *struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"vendorsDocument"`
|
||||
} `json:"node"`
|
||||
}
|
||||
|
||||
err = owner.Execute(
|
||||
orgQuery,
|
||||
map[string]any{"id": owner.GetOrganizationID()},
|
||||
&orgResult,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, orgResult.Node.VendorsDocument)
|
||||
assert.Equal(t, docID, orgResult.Node.VendorsDocument.ID)
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
func TestVendor_PublishVendorList_RBAC(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
owner := testutil.NewClient(t, testutil.RoleOwner)
|
||||
viewer := testutil.NewClientInOrg(t, testutil.RoleViewer, owner)
|
||||
|
||||
factory.CreateVendor(owner, factory.Attrs{"name": "RBAC Vendor"})
|
||||
|
||||
const query = `
|
||||
mutation($input: PublishVendorListInput!) {
|
||||
publishVendorList(input: $input) {
|
||||
documentEdge { node { id } }
|
||||
documentVersionEdge { node { id } }
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
t.Run(
|
||||
"viewer cannot publish vendor list",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
err := viewer.ExecuteShouldFail(
|
||||
query,
|
||||
map[string]any{
|
||||
"input": map[string]any{
|
||||
"organizationId": owner.GetOrganizationID(),
|
||||
},
|
||||
},
|
||||
)
|
||||
testutil.RequireForbiddenError(t, err)
|
||||
},
|
||||
)
|
||||
}
|
||||
@@ -29,8 +29,8 @@ func TestMCP_Snapshot(t *testing.T) {
|
||||
mc := testutil.NewMCPClient(t, owner)
|
||||
orgID := owner.GetOrganizationID().String()
|
||||
|
||||
// Create a vendor so the snapshot has data
|
||||
factory.CreateVendor(owner)
|
||||
// Create a risk so the snapshot has data
|
||||
factory.CreateRisk(owner)
|
||||
|
||||
// Take snapshot
|
||||
var takeResult struct {
|
||||
@@ -41,7 +41,7 @@ func TestMCP_Snapshot(t *testing.T) {
|
||||
mc.CallToolInto("takeSnapshot", map[string]any{
|
||||
"organizationId": orgID,
|
||||
"name": factory.SafeName("Snapshot"),
|
||||
"snapshotsType": "VENDORS",
|
||||
"snapshotsType": "RISKS",
|
||||
}, &takeResult)
|
||||
require.NotEmpty(t, takeResult.Snapshot.ID)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user